i ENCRYPTION APPARATUS 

! 

USING DATA ENCRYPTION STANDARD ALGORITHM 



Field of the Invention 



The present j invention relates to an encryption 
apparatus; ana, mo're particularly, to a pipelined encryption 
apparatus using dajta encryption standard algorithm. 

10 Description of the Prior Art 



DES (Data Encryption Standard) algorithm has come to the 
more attention iri this environment of the wider usage of 



networks. Especially , the DES is widely used in Internet 
15 security applications, remote access server, cable modem or 
satellite modem, i 

i 

The DES is . fundamentally a 64-bit block cipher having 

i 

64-bit block input and output, 56 bits among the 64-bit Key 

block for encryption and decryption and remaining 8 bits for 
20 parity checking, trhe DES receives a 64-bit plain text block 

and outputs a 64-bit cipher text generated from the 64-bit 

plain text block and the 56-bit key. 

In a ^iajor| technique, the DES is implemented by 

permutation (P-BoL) , substitution (S-Box) and. key schedule 
25 generating a'subkey. 

Inside of dajta encryption is implemented in such a way 

' i 

to iteration, of jl6 round operations and constructed by an 



10 



15 



20 



25 



initial permutation (IP) of input part and an inverse initial 
permutation (IJ?" 1 ^ pf output part. 

i ! 

Fig. 1 is a klock diagram of a general DES architecture. 

Referring to Fig- 1, the general DES architecture 
includes an initial permutation unit 110, a DBS encryption 
unit 120 and an inverse initial permutation unit 130. 

in the DES encryption unit 120, 64-bit plain text block 
undergone an IP ujiit is divided into two blocks, respectively 
registered, at a fjLrst left register (Lo) and a first right 

register (R c ) - Ati jevery round, 32-bit data registered at the 

i 

left register and the right register undergoes a product 

transformation £nd a block transformation. The inverse 

initial permutation unit 130 performs the inverse initial 

i i 

permutation .(IF -3 |)j of 64-bit data transformed by 16-round 
operation and outpjuts a cipher text block. 

The basic operation unit 120 includes a plurality of 
cipher function urjits 121 and exclusive-Oft (X-OR) units 122. 

i 

32-bit data ! registered at the first right register (Lo) 
i , 

is encrypted 'by tihe cipher function unit f 121 using the sub- 
key (Ki) from a !k^y scheduler and the encrypted 32-bit data 
is X-ORed yith thje 32-bit data registered at the first left 
register (L 0 ) at , jhe X-OR unit 122, 32-bit data from the X- 
OR unit 122 is registered at a right register (Ri) and the 
32-bit data rsgisitered at the first right register (R 0 ) is 
swapped and registered at a left register (L x ) in a next 
round, which is - [referred as x one round operation' . In DES 
architecture, 16' round operations are performed by iteration 



i 



of one rgund operation. 



<2) > 



16-round operation can be expressed as equation (1) and 

' i 



Li-Ri-l 1=1/ 2\ . . . IS (1) 



1 i 

Ri-Li-x ffi f (Rili, Ki) i=l, 2, ... 16 (2) 



Fig- 2 is I |a block diagram of a conventional key 

i 

10 scheduler generating a aubkey. 

Referring toj Fig. 2, the conventional key scheduler 
includes a first - permutation choice (PCI) unit 200, a first 
and a second shift units 220 and 230, emd a second 
permutation choice (PC2) unit 240. 

15 The first permutation choice (PCI) unit 200 performs 

permutation of 3 el-bit key data. The permutated 5 5 kit key 
data is divided! ! two 28-bit blocks, and the blocks are 

registered in rejgjisters C 0 and D 0 - Each of the shift units 

\ i 

220 and 230 respectively shifts corresponding 23 bits 

, i 

2 0 registered in Ci 1 ^nd D± (i=0, 1, . . 15). The shifted key 

data blocks are registered in a next round registers Ci-ui and 
Di+i- The second i permutation choice (PC2) unit 240 performs 

i ■ 

permutation of 28-bit blocks registered in the registers 
and Di to output 'aj 48-bit subkey Ki . 
25 During lG-roind operation, the key data blocks of d and 

Di are shifted by, 28 bits, such that the data registered in 
Co and D 0 are' equal to those registered in Cie and Di S . 



Fig. 3 is a derailed diagram of a cipher function unit 
and a S-Box permutation unit of a general DES architecture. 

Referring to- -Fig- 3, the cipher function f includes an 
expansion pertmutat,ion unit 310, an exclusive-OR (XOR) unit 
5 320, an S-Box' permutation unit 330, a P-Box permutation unit 
340 and an XOR unit 3 50. 

i 

The expansibri permutation unit 310 performs expansion 

l ! , 

permutation civer ' 32-bit data (Ru-u) from a right register 

i 

registering 3i2-fc>it' text block to output 4 8-bit data- 
10 The XOR unit -320 performs XOR operation over the 48-bit 

data from the expansion permutation unit 310 and a subkey 
(Ki) from a key scheduler, 

The S-B6x permutation unit 330 performs substitution 
over 48-bit data ifirom the XOR unit 320 to output 32-bit data. 

15 The P-Bojx pe' mutation unit 34 0 performs permutation over 

i j 

32-bit data fjrom ,the S-box permutation unit 330. 

The XOR junit |350 performs XOR operation over 32-bit data 
from the P-Bbx permutation unit 340 and 32-bit data (La-u) 
from a left segistier. 

20 The keyi scheduler includes a first permutation choice 

i 

(PCI) unit ^60, two shift units 370 and 330 and a second 
permutation Choice (PC2) unit 38 0 . Each of the shift units 
160 and 170 irespdctivsly shifts corresponding 23 bits, half 

of 5 6-bit key data. 

1 i 

25 The FC2i unit 3 90 receives two blocks from the shift 

i ; 

units 160 and 170: to compress them to the sub key. 

i ' 

In particulate the S-Box permutation unit 330 includes 8 



4 



i 



S-Boxes for receiving 4 8-bit data and outputting 32-bit data. 
That is, 48-bit data block is divided into 8 6-bit data, each 

applied to thj=i corresponding S-Sox Of the 8 S-Boxes and each 

i 

of the 8 S-Bjoxes outputs 4-bit data- Accordingly , 43-bit 

i i 

5 data is pernulitated to 32-bit data. The S-BOX permutation 
unit 330 requires a memory, e.g., a programmable logic array 
(FLA) or a read only memory (ROM) , because it employs table 
look-up technique- Since each of the S-Boxes outputs 4 bits 
for S- bit input, it requires 64 x 4 memory capability and 
10 the S-Box permutation unit: 130 requires 8 x 64 x 4 memory 

capability. ! Accordingly, the s-Box permutation unit 330 

i 

takes relatively large area in a chip. 

Generally, there are lots of data blocks to be encrypted 
are with compared to a given key in many cases- At this time, 

15 performance jof encryption can be increased by using a 

i 

pipeline structure. Pipelines used in the DES architecture 



are classified as 
accordance with a 



a micro pipeline and a macro pipeline in 
level to which is applied, 

The micro pipeline structure is a structure pipelining 

; I 

20 an iterative ! 16-r^und operation of the DES encryption unit, 
and the micrb pipeline structure can be extended up to 16- 
step. If M-sjtep micro pipeline structure is used/ M plain 

i 

text blocks, can be simultaneously encrypted, thereby 

I 

increasing the throughput of the encryption apparatus by M 



25 times. 



However, 



since M-round DES operations are 



simultaneously performed, M S-Box permutation units are 

i' 

necessary in i order to prevent data contention problem. Since 



additional S-^OX permutation units are should be implemented, 
the chip size! of the encryption apparatus is increased- Also, 
the M-step pipeline structure always has a latency of IS 
clock cycles . ■ j 

Fig. 4 is a block diagram of a conventional 3-step macro 

pipeline DES architecture, 

! • i 

Referring to! Fig- 4, the conventional 3-step macro 

i 1 

pipeline DES Architecture includes three steps. 

i 

in a first - istep, 54-bit data from first-input-first- 
output (FIFO), register is sequentially inputted to eight (8) 

I 

input buffer Registers (IBR) . in a second step, 64-bit plain 
text block lis received from the IBR and performed of 
encryption operation, thereby outputting 64-bit cipher text- 
in a third step* 1 the 64-bit cipher text is outputted from 
eight (S) outjput fcjuffer registers to a FIFO register. 

A period of the macro pipeline is decided in accordance 

with a maximum tiifte among times for data input, DES operation 

i 

and data output. , 

A data input j rate to the DES encryption unit is decided 
based on a speed] of the DES encryption unit rather than a 
speed of the; encryption system. In case of DES architecture 
used for networking, the period of the macro pipeline is 

decided in accordance with a maximum transmission rate of a 

l 

modulator and a demodulator, and a spsed of an external host 
microprocessor . ; 

In general, Ian input/output rate of the DES encryption 
unit is slaw;. Sii^ce the data is moved byte-by-byte (8 bits) 



in the external system of the DES encryption unit and the DES 
encryption unit performs encryption of 64-bit data and 
outputs encrypted .64-bit data f there are necessary an input 
register and an output register. Th& input register gathers 
eight bytes of input data and transmits the gathered eight 
byte data to the j DES encryption unit, The output register 
output eight byte data by one byte. 

As mentionedj above, the conventional micro and macro 
pipeline architecture has a large size and a slow speed. 

i 

Summary of th|e Invention 

Therefore, it is an object of the present invention to 
provide an encryption apparatus having a small size, a high 

speed and minimum jpower consumption. 

i 

In accordance with an aspect Of the present invention , 
there is provide^ an apparatus for encrypting 64-bit plain 
text blocks, comprising: input buffering unit for receiving a 
plain text block :byte-by-byte and outputting a first and a 
second 32-bit plain text blocks in response to a first clock; 
encryption unit for performing time multiplexed encryption of 

the first and the i second 32-bit plain text blocks in response 

s 

to the first cloqk and a second clock, thereby generating a 

! 
I 

first and a seco'nd 32-bit cipher text blocks; and output 
buffering unit for receiving the first and the second 32-bit 
cipher text blocks in response to the second clock and 
outputting eight 8-bit cipher text blocks- 



Brief Description of the Drawings 
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The* above arid other objects and features of the instant 

invention will become apparent from the following description 

i 

of preferred embodiments taken in conjunction with the 

i 

accompanying drawings, in which r 

Fig. 1 is a block diagram of a general DES architecture; 
Fig_ 2 is > |a block diagram of a conventional key 
scheduler generating a subkey; 

Pig. 3 is a 'block diagram of a cipher function unit and 

m unit of a general DES architecture; 
Fig. 4 ±55 & block diagram of a conventional 3-step macro 
pipeline DES architecture; 

block diagram of a general DBS encryption 



a S-Dox permutatilo 



Fig. 5A is a 



15 unit; 



Fig, SB is |a 

DES architecture;! 1 

1 i 
i 

Fig, 6 is si 



block diagram of a 2-step micro pipeline 



block diagram of DES architecture using a 
macro pipeline ; and a micro pipeline architectures in 
accordance with the present invention; 

Fig. 7 is a 'detailed block diagram of a time multiplexed 



cipher function; 
invention; 



unit in accordance with the present 



Fig. 8 is a block diagram of a key scheduler of the time 

1 ! 

multiplexed -cipher function unit in accordance with the 
present invention; 

timing diagram for explaining operation of 
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Fig- 9 is a 



the DES architecture having the macro pipeline and the micro 
pipeline structures in accordance with the present invention; 

Fig. 10 is a 'timing diagram for explaining operation of 
the key scheduler ;of the time multiplexed cipher function in 
5 accordance with this present invention; 

Fig, 11 is a j timing diagram for explaining operation of 
the conventional i6-round DES architecture and the 8-round. 
DES architecture ojf the present invention; and 

Fig. 12 is a' timing diagram for explaining performance 

10 of the conventional. 16-round DES architecture and the 8-round 

! 

DES architecture o|f the present invention. 

i 

1 i 
i 

Preferred Embodiment of the Invention 

i 

15 Hereinaf ter r j preferred embodiments of the present 

invention will be 1 described in detail with reference to the 

i 

accompanying drawings . 

i 

Fig. 5A is a| block diagram of a general DE5 encryption 

i 

unit, and Fig. SB is a block diagram of a 2-step micro 

20 pipeline DES architecture. 

Referring to i Fig. 5A, in a general DES architecture, two 
32-bit blocks L 0 ! and R 0 which are performed of initial 
permutation are registered in a left and a right registers in 
response to a clook- In each round, product transformation 

25 and block transformation are performed. The 32-bit block 
registered in the 1 right register R 0 is encrypted by a cipher 



function f and 



then X-ORed with the 32-bit block L Q 
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f I 

registered in the] left register by an exclusive-OR (X-OR) 
unit r which is referred as the product transformation, 32-bit 
data from the ! X-dn! unit is swapped with 32-bit data from the 
right register and! registered in the right register, which is 
referred as the , klock transformation, in the general DES 

architecture,; there is a problem that 16 clock cycles are 

i < 

necessary foz: thte DES operation because of the input 
operations tp tjije registers. 32-bit block data can be 
expressed toy equation (3) based on equations (1) and (2) > 



i : i 

; I 

I \ | 

Referring to Fig. SB, 2-step micro pipeline DES 
architecture ; includes two steps, in a first step, an initial 
32-bit block, R 0 is encrypted by a cipher function f A 550 
using a subkey K& jfrom a key scheduler and the encrypted 32- 
bit data is X-0re|d with an initial 32-bit block L 0 . 32-bit 

i | 

data Rx froiri the; X-OR unit 560 is registered at a right 

register BO 510 ' in response to a first clock (CLK2) . In a 

second step, the j 32-bit data block registered in the right 

register BO is enbrypted by a cipher function £ B 520 using a 

j i 

sub-key K B from 'the key scheduler and the encrypted 32-bit 
data is X-Ored with the initial 32-bit block R 0 . 32-bit data 
R s from the X-OR ;\|nit 530 is registered at a left register AO 
540 in response t6 a second clock (CLKl) . 

In the 2-step micro pipeline DES architecture, since 
encryption operations are performed based on the equation (3), 

| 

i io 



the 32-bit blpeks jare registered in response to two clocks, 
in one period • for which one register maintains the registered 
values, the other register can register a new value. In other 

i 

words, for one period, one register maintains a value and the 
5 other register can register a new valu$. If allies of 
permutations R± (ipl, 2, ... 16) are alternatively stored 
two registers, adjacent values o£ can be accessed for a 

half of a period.-! Since the values Ri_i and Ri-2 computed in 
the previous j rounds can toe accessed within a half o£ one 
10 period, in o'rder j to alternatively store the values of Ri 
computed by the equation (3), the cipher function operation 
should be performed within a half of one period. In other 
words, two cipher j function units are time-multiplexed in one 

period, two cipher function units can 'be implemented by using 

i 

15 a S-Box permutatidn unit, 

Preferring to Fig. 5B r the micro pipeline DES includes 
two registers of\ which clocks are inverse and a time 
multiplexed cipher function unit. The micro pipeline DES does 
not simultaneously encrypt two plain text blocks, however, 

20 reduces a number df clocks necessary for encrypting one plain 

text block, thereby minimizing power consumption of the DES 

i 

chip. Since lone * j3-Eox permutation unit is used, the micro 
pipeline DES ' has Ismail size similar to the DES architecture 
of Fig- 5A. 

25 Fig. 6 is a ! block diagram of DES architecture using a 

macro pipeline iand a micro pipeline architectures in 

: ■ i 

accordance wi^th tljxe present invention. 

' 1 11 



Referring "CO ! Fig. 6, the macro pipeline includes three 
i 

steps. In a first, step, 64-bit input data block is divided 
into eight S-biti blocks , every four 8-bit blocks are 
sequentially inputted, gathered and stored into a left input 
5 buffer register (IBR(L)) 610 and a right input buffer 
register (IBR(R)) 620. In a second step, each 32-jbit data 
block from the left and the right input buffer registers is 
alternatively inputted to a first and a second cipher 
function units and encrypted for 8 rounds. In a third step, 

10 each 32-bit data block is divided into four 8-bit blocks and 
outputted by 8-biit block through a left output buffer 
register (OBR(L}),' 640 and a right output buffer register 
(OBR(R)) 650. i 

In more detalil description of the second step, 32-bit 

15 data block A± registered in the left input buffer register 
(IBR(L)) 610 is encrypted by the cipher function (f A ) 634 
using the sub-key K A from the key scheduler, the encrypted 
data block is X-Olied with the 32-bit data block Bi registered 
in the right inpu't buffer register 620 by a X-OR unit 635, 

20 32-bit data from the X^OR unit 635 is registered in a right 
register (B0), 636j in response to a second clock OCLK) . 32- 
bit data block ' Bi registered in the right input buffer 
register (I BR (R) ) 1 620 is encrypted by the cipher function 
(fs) 631 using the sub-key K B from the key scheduler, the 

25 encrypted data block is X-ORed with the 32-bit data block A* 
registered in the! left input buffer register 610 by a X-OR 
unit 632. 32-bit data from the X-OR unit 632 is registered in 
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a left register (AO) 633 in response to a first clock (CLK) - 

While data in£>ut /output is performed 64-bit by 54-bit in 
the DES encryption; unit, data input /output in outside of the 
DES encryption unit is performed 8-bit by 8-bit out of the 
DES encryption uniit. Latencies du« to input/output into/from 
the DES encryption unit can be hidden by using 3-step macro 
pipeline DES architecture. 

while ttje conventional DES architecture illustrated in 
Fig. 5A respectively computes and stores R± and Li in two 

registers 16. tinups, the DES architecture in the present 

j 

invention computes! only R± and alternatively stores Ri in two 

registers- In othdr words, each register stores R± only eight 

i 

times. The input of the register AO is IBR (L) © f A or AO© £ B , 



and the output of 



the register AO is used for operation AO© 

f B or stored jin the register OBR(L). Output of. the register 

i * 

BO is used for operation BOffi f A or stored in the register 

i 

OBR(R) - 1 ; 

i 

Fig- 1 is a Retailed block diagram of a time multiplexed 

cipher function urj.it in accordance with the present invention. 

| i 

Referring to j Fig. 7 r a time multiplexed cipher function 
unit includes twoj expansion permutation units 710 and 720, 
two exclusivel-OR (X-OR) units 730 and 740 , a multiplexer 750, 
a S-Box pemjutafcijon unit 7 60, a F-Bo* permutation unit 77 0 
and a demultiplexer 780. 

A 32-fc>it datia block Ai is expanded to 48-bit block by 

I 

the first ekpan's^Lon permutation unit 710 - The 4 3 -bit block 
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is X-ORed with a sub toy K a from the key scheduler by the X-OR 

unit 730. A 32-bit! data block Bi Is expanded to 48-bit block 

■ i 

by the second expansion permutation unit 720. The 48-bit 

i 

block is X-ORed with a subkey K c from the key scheduler by 
5 the X-OR unit 7 4-Oj. One o£ the 48-bit blocks from the X— OR 
units 720 and 740, M selected by the multiplexer 750 based on 
a selection signal- The 46-bit data block is stored in and 

substituted into ■ 32-bit data block by the S-Box permutation 

I 

unit 7 60. Th* 32j-jbxt data block from the S-Box permutation 
10 unit 7 SO is p ; ermUt|ated by th* P-Box permutation unit 770. The 
32-bit data block: from the P-Box permutation unit 77 0 is 
outputted by the | demultiplexer 780 based on the selection 
signal- . | 

i 

The multiplexer 750 and the demultiplexer 730 operated 
15 based on the selection signal output 32-blt data f A at a 
first half period of the first clock (CLKl) and 32-bit data 
f B at a second hklf period of the first clock (CLKl) ■ In 
other words, th^ time multiplexed cipher function unit 
receives and' performs cipher function of 32-bit data Ai and 



20 the sub- key K& an,d 
first clock (CLKl 



outputs fx for the first half period of the 
) by using the expansion permutation unit 



710, the X-QR unit 730 f the S-Box 760 and the P-Box 770. The 
time multiplexed, (cipher function unit receives and performs 

cipher function of 32-bit data B± and the sub-key K& and 

! 

25 outputs f B for tlje second half period of the first clock 
(CLKl) by using the expansion permutation unit 720, the X-OR 
unit 740 F the S'-pox 760 and the P-Box 770. The expansion 
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permutation ujnits 710 and 720 are implemented by wiring and 
the s-box permutation unit 760 is by a ; read only memory (ROM) 
or a programmable jlogic array (PLA) . In the DES apparatus of 
the present j invention, two cipher functions in the time 
multiplexed cipher function unit are* operated for one period 
by using one S-Bdx permutation unit. 

Fig- 8 ife a block diagram of a key scheduler of the time 
multiplexed biph'er function unit in accordance with the 
present invention. 

Referring to Fig. 8, the key scheduler of the time 
multiplexed dipher function unit includes two key scheduling 



units each having 
two register^ 810 



a first permutation, choice (PCI) unit 800, 
end 820, shift units 830 and 340, and a 



second permutjatidri choice (PC2) unit 8 50. 

In a f:Lrst ! key scheduling unit, the PCI unit 800 
performs permutation of 56-bit key data- Each of registers 
(C A ) 810 and ;(D A ) [ 320 stores 28 bits, half of 56-bit key data 

in response to a i first clock (CLK1) . Each of the shift units 

i ■ 

830 and 340 ^respectively shifts corresponding the 28-bit key 
data from thte registers by a predetermined number of bits, 
e.g., two, three,! jor four bits. The second permutation choice 
unit S50 receives |two 28-bit key blocks and generates a first 
sub key K A . j | j 



A second key 



scheduling unit has the same elements as 



the first kky scheduling unit, however, each element is 

! 1 | 

operated in resporj.se to a second clock (-CLK1) . 



The number p 



f shifted bits in the shift units 330 and 



15 



is not critical 



840 at each round; is described in tables of Fig. 8, 

The key' scheduling unit includes ' two shifters and 
registers ancf the \ PCI and PC2 units 600 and 850 implemented 

i I 

by wiring. Since ' a size of an additional' 56-bit register is 
veiry small as coijpared with that of the S-Box permutation 
unit/ the additional 56-bit register takes relatively small 
area in a chip. '.Accordingly , the additional 5 6-bit register 

problem in integrating the encryption 
apparatus in 'a chip- 
10 Fig- 9 is aj timing diagram for explaining operation of 

the DES architecture having the macro pipeline and the micro 
pipeline structu^s in accordance with the present invention. 

Referring to Fig- 9, the DES architecture receives 
initial permuted! plain text (yo, zq) 7 (ao* bo), <c 0/ do) in. 
15 order and computes! z i7 bt, di (i=l, 2, , • , , 16) and outputs 
(z ie , zis) r (bis, bit), <dis f di§) . 

For easy description, only process of computing bi from 

(a 0 , b 0 ) and • outpitting (big, bi 5 ) will be described, 64~bit 

■ i 

plain text after ' Initial permutation is divided into two 32- 

20 bit blocks ao and bo- In other words, a 0 = L 0 = R-i, and b 0 ^ Ra- 

; I 

The DES encrypticjri unit computes values bi> b 2 , . . - , bx& {b± 
= Ri) . Befor;e computing b± r a subkey Ki is provided to a 
cipher function unit from a key scheduler . 

For eiglit cycles before t Q , data which is inputted byte- 
25 by-byte is gathered in the input buffer register (IBR). The 
left buffer register (IBR(L)) remains b 0 and the right buffer 

remains ao at [to-tj] - At a next clock, each 



register (IBR(R) ) 



16 



of the input buffer registers gathers one byte of a next 

i ■ 

plain next block! i Co and do- After eight clocks, the input 

■ ! \ 

buffer registers jrjemain Co and do at [tie-tig] > 

The output inffer registers (OBR) load from zie and zis 

5 from AO and BO at t lf and output the inverse permuted data 

i ! 

block at ti byte-by-byte for 8 cycles . 

! i 

ao and b! 0 registered in the input buffer register (IBR) 

can be accessed at! [tQ-ti] , the cipher function f a is computed 

! t 

at [to-ti] by using the subkey from the key scheduler, bi*- 
10 a 0 © f(b 0 , K x ) canjbe stored in the register BO at ti- 

Since b 0 and ; bi registered in the IBR (L) and BO can be 
accessed at i[ti-fc^] , the cipher function fa is computed at 
[ti-t 2 ] by using! ! the subkey K 2 from output K B of the key 
scheduler, b 2 ^ b 0 j© f (b L , K 2 ) can be stored in the register AO 

15 at ta. i i 

I i 

since bi arid bs registered in the BO and AO can be 

j j 

accessed at , [ts-jtjj] , the cipher function f a is computed at 
[t 2 -t 3 ] by using ! the subkey K 3 from output K A of the key 



scheduler,. b 3 = bj. 
20 at t 3 . 

Computation 



f (hzr K3) can be stored in the register BO 



\6f bi is started at to, and then, each of bg, 

b 3 , . . . , 'bia ib computed and stored at the corresponding 

! ! 

register, After eight clocks, b i5 is stored in the register 

1 

AO at tis, thereby terminating DES operation of e. 0 end b D . 

: i 1 

25 Simultaneously, EES operation of co and do is performed at tie. 

i .; 

The subkey ; ^ 2, . - . , 16) is 4 8 -bit block 



: ' 17 

i .; 
i i 

1 ! 



generated by dividing the 5 6-bit initial key data from the 
first permutatioii \ choice (PCI) unit into two 28-bit blocks, 
by shifting each df the 28-bit blocks by 1/ 2, 4, 6, 3, 10, 

i 

12, 14, 15, 17, 19, 21 r 23, 25, 27, , 23 (=0) bit(s), and by 
5 permuting the shifted blocks in the second permutation choice 
(FC2) unit. ' j 

In the present invention, since the cipher function 
performs a time rntaltiplexed operation, two cipher functions 
are operated and; two subkeys are generated for a period. In 
10 order to generatp two subkeys for one period, two key 
scheduling units ! iach performing having S-round operation of 
Fig- S are used: |A first key scheduling unit is driven in 
response to the first clock (CLK1) and generates Ki, K 3r K 5 , 
K7/ K 9 , Kn, K13, ki5 for S rounds, a second key scheduling 
15 unit is driven Irk response to the second clock (CLK2) and 
generates K 2 , K 4 ,.k s , Kg, K^o, Kia, K14, Kie for 8 rounds. 

Fig. lO.is k\ timing diagram for explaining operation of 

the key scheduled I of the time multiplexed cipher function in 

1 

accordance with the present invention, 
20 Referring to! Fig. 10/ Ka and K B denote access times to 

the subkeys necessary for the time multiplexed cipher 
function units. t£ a and TS B denote numbers of shifted bits of 
the initial key block after the first permutation choice unit 

(PCI) > (C R , D a ) and {C B , D H ) denote the .subkeys obtained by 

1 i 

25 permuting output' data blocks of the registers C A , D A and C B , 
D3 through the second permutation choice unit (PC2) . S A and S B 



denote numbers o 



shifted bits in each round (Pi, Qi) in 
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I 

I 



order to obtain the total numbers of shifted bits described 

i " i 

in tSa and ts e . , j 

Processes fori generating the subkey will be described. 

In a first round (P 0 , Qo) / Since TS> and TS B are 1 and 2, 
the subkeys K x an<k K 2 are generated by shifting the initial 
key from the PGll by one and two bits and permuting the 
shifted key blocks) through the PC2 . 

In a second ijound {Pi, Qi) , since TS A and TS S are 4 and 6, 
in order to generate the subkeys K 3 and K$ r the left shifters 



and 4 (-6-2) bits, 



10 shift the key blocks stored in the corresponding registers to 
left by 3 <=4i-l) 

In a third round (P 2 , Q z ) , sine© TS A and TS B are S and 10, 
in order to generate the subkeys Ks and K e , th© left shifters 

shift the key 1 bldciks stored in the corresponding registers to 

, , i 

15 left by 4 (=B,-4) and 4 (=10-6) bits. 

j 

in each routed (Pi, Qi) , the key blacks stored in the 

I 

corresponding registers are shifted to left by and S B bits, 

and the key 'blocks are shifted by TS A =27 and TS B =2S(^0) in 

, , i 

the eighth round j(P 7 , Qi) > Then, in order to return to the 
20 first round, i-e'-!, TS A =1 and TS B _ 2, S* and S H should be two 
(2) respectively- (However, in case that initial DES operation 

i 

is performed ,or ttje initial key is stored in the registers C A 

i 

and after a res let of system, is one (1) . 

Fig. 11 is aj timing diagram for explaining operation of 

25 the conventional' jl6-round DES architecture and the S-round 

! 

DES architecture , of the present invention- 



Referring to 



Fig. 11, the DES encryption apparatus of 
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the present invention performs operations faster than the 
conventional DES encryption apparatus. 

Fig. 12 is a | timing diagram for explaining performance 
of the conventional 16-round DES architecture and the 6-round 

)f the present invention.' 
Fig, 12, the a-round DES architecture of 



DES architecture -o 
Referring to 



the present invention can reduce power consumption. 



The architecture of the 



resent invention can be 



extended. For etfaltnple, 2N-step micro pipeline architecture 

i 

can be implemented by combining N two-step micro pipeline 
architectures in .serial- The extended architecture includes N 
cipher functijon units which are not time multiplexed, N S-Box 
permutation uiaits are necessary, hovever r N plain text blocks 
can be simultaneously encrypted for 8 rounds. In other words r 
the throughput of the encryption apparatus is increased by N 
times* 

M-step micro pipeline architecture can be implemented by 
combining M micro pipeline architectures of Fig. 5B in serial. 
The extended architecture should have M S-Box permutation 

units, M plain teixt blocks can be simultaneously encrypted 

j 

for 16 rounds. : jln other words, the throughput of the 
encryption apparatus is increased by M times. 

Comparison of four architectures are described in table 

l. 



[Table 1] 





Latency 
[(cycle) 


through- 
put 


S-Box 
permutation 
unit 


Core 
register 


virtual , 
2- stop pipeline 


; , 8 


1 


1 


2 


general 
1-step pipeline 


; i i6 

i [ 


1 


1 


2 


virtual 
4-step pipeline 


, ! 8 

: i 


2 


2 


4 


general 
2— step pipeline 


i 


2 


2 


4 


virtual 
S-step pipeline 




4 


4 


8 


general 
4-step pipeline 


, i 16 
' \ 


4 


4 


8 


virtual 16-step 
pipeline 


: i 


8 


8 


16 


general 
8-step pipeline 


i 16 

r 


8 


8 


16 
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As described [above, in the present invention, by using 

, i! 

2-step pipeline 'architecture, values of 16 registers are 

ii 

computed and alternatively stored in the corresponding 
registers, and therefore, DES encryption operation is reduced 
from 16 rounds' | to 8 rounds, thereby reducing power 
consumption due tp switching. Using 3-step macro pipeline 
architecture having input, DES encryption operation and 
output, latency die to low rate data input /output can be 
hidden into DES ; operation time, to thereby increase 
efficiency off macro pipeline. Since only one S-Box 
permutation unit ik used by time dividing the cipher function 
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! 

unit, size of, the Encryption chip is minimised. The number of 
plain text blocks which are simultaneously encrypted is 

increased by extending the pipeline architecture. The 

j 

encryption apparatus of the present invention reduces the 

i 

5 power consumption ]by using the slower clock than that of the 
conventional encryption apparatus by two times. Therefore, 
the encryption apparatus has a small size and a low 
consumption. i 

Although the preferred embodiments of the invention have 

10 been disclosed for illustrative purposes, those skilled in 

i 

the art will apprepiate that various modifications, additions 
and substitutions j are possible, without departing from the 
scope and spirit; of th^ invention as disclosed in the 

accompanying claims « 

i 

15 
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